STAND. COM. REP. NO.  1750-08

Honolulu, Hawaii

                , 2008

RE:   S.B. No. 2803

      S.D. 1

      H.D. 1

Honorable Calvin K.Y. Say

Speaker, House of Representatives

Twenty-Fourth State Legislature

Regular Session of 2008

State of Hawaii

Sir:

     Your Committee on Finance, to which was referred S.B. No. 2803, S.D. 1, entitled:

"A BILL FOR AN ACT RELATING TO PERSONAL INFORMATION,"

begs leave to report as follows:

     The purpose of this bill is to protect the personal information collected and maintained by state and county agencies through the implementation of the recommendations of the "Hawaii Identity Theft Task Force Report" of December 2007.  Specifically, this bill:

     (1)  Requires each state and county agency to designate an employee to ensure the agency's compliance with requirements relating to the security of personal information;

     (2)  Establishes the Information and Privacy Security Council to be placed administratively within the Department of the Attorney General and appropriates funds for three staff analyst positions to support the Council;

     (3)  Changes the effective date of Chapter 487J, Hawaii Revised Statutes, relating to social security number protection, to July 1, 2009;

     (4)  Requires conditions on third party personal information use to be included in contracts between government agencies and third parties that provide support services on behalf of the agency;

     (5)  Requires state and county agencies that collect, maintain, or disseminate documents with personal information to:

          (A)  Develop and implement a plan to protect the personal information; and

          (B)  Develop a written plan to eliminate unnecessary collection and use of social security numbers;

     (6)  Requires state and county agencies responsible for human resource functions to develop and distribute to agencies, guidelines to minimize unauthorized access to personal information;

     (7)  Requires state and government agencies to develop a written policy regarding notification of security breaches of personal information; and

     (8)  Defines the terms:  "government agency," "personal information," "personal information system," "records," and "security breach."

     The Department of Education, Hawaii Financial Services Association, and Retail Merchants of Hawaii testified in support of this bill.  The Department of the Attorney General and University of Hawaii testified in opposition to this measure.  The Judiciary, Department of Human Resources Development, Department of Accounting and General Services, Department of Human Resources of the City and County of Honolulu, Department of Human Resources of the County of Hawaii, and Department of Personnel Services of the County of Maui provided comments.

     Your Committee has amended this bill by:

     (1)  Deleting parts VI and VII that required state and county agencies that collect, maintain, or disseminate documents with personal information to:

          (A)  Develop and implement a plan to protect the personal information; and

          (B)  Develop a written plan to eliminate unnecessary collection and use of social security numbers;

          and

     (2)  Making technical, nonsubstantive amendments for clarity,      consistency, and style.

     As affirmed by the record of votes of the members of your Committee on Finance that is attached to this report, your Committee is in accord with the intent and purpose of S.B. No. 2803, S.D. 1, as amended herein, and recommends that it pass Third Reading in the form attached hereto as S.B. No. 2803, S.D. 1, H.D. 1.

Respectfully submitted on behalf of the members of the Committee on Finance,

____________________________

MARCUS R. OSHIRO, Chair